Forensia CTI Core

About

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.

Platforms: Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

4 known groups

G0046 FIN7 G0091 Silence G1003 Ember Bear G1055 VOID MANTICORE

Software

31 malware/tools implement this

DerusbiT9000CrimsonEvilGrabPupyBandookInvisiMoleQuasarRATKazuarjRATAgent TeslaRemcosDarkCometNanoCoreCobian RATEmpireRevenge RATnjRATMacheteZxShellPoetRATImminent MonitorSDBbotTajMahalConnectWiseObliqueRATClamblingWarzoneRATPcShareAsyncRATQuick Assist

Corpus indicators tagged with this technique

78 indicators in the corpus carry T1125.

Indicator	Type	Family	Sev	Src
5f3a9ebf7039097b3cdbca8609b5b68af07eeb1dbf716ba2817a97fc7c543854	sha256	supply_chain	80	1
79c09e1ffb4804c14ff27d41ec08d4390455c92d65717be0aeeec2697297d76a	sha256	supply_chain	80	1
e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0	sha256	supply_chain	80	1
d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1	sha256	supply_chain	80	1
4d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305	sha256	supply_chain	80	1
011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972	sha256	supply_chain	80	1
e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c	hash	—	80	3
3e7066e44132e64360a30974b6ea3671	hash	—	80	3
40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5	hash	—	80	3
2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d	hash	—	80	3
ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1	sha256	supply_chain	80	1
9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b	sha256	supply_chain	80	1
de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2	hash	—	80	3
0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8	hash	—	80	3
3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d	hash	—	80	3
314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef	hash	—	80	3
4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d	hash	—	80	3
584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8	hash	—	80	3
66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d	hash	—	80	3
8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0	hash	—	80	3
9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73	hash	—	80	3
a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295	hash	—	80	3
0ffb16209def5500ff4380d9e8093437	hash	—	80	3
900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e	sha256	supply_chain	80	1
483a36fb9e4aef9704aa1e4edfb88c492dfe4140	hash	—	80	3
d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609	sha256	supply_chain	80	1
7b2c661cfb69e9c75df90d5102647bb014c28ad5	hash	—	80	3
372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985	sha256	phishing	80	51
a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad	hash	—	80	3
23808e7638f7a00b1ef9b9f4ca524f8a46cf63be6f6b79fec8e4a3fd1cc82a1e	sha256	supply_chain	80	1

Showing the top 30 by severity of 78.